rules:
- id: file-disclosure
  message: >-
    Special requests can determine whether a file exists on a filesystem that's outside
    the Ruby app's
    root directory. To fix this, set config.serve_static_assets = false.
  metadata:
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_file_disclosure.rb
    - https://groups.google.com/g/rubyonrails-security/c/23fiuwb1NBA/m/MQVM1-5GkPMJ
    category: security
    technology:
    - ruby
  languages:
  - ruby
  severity: ERROR
  pattern: config.serve_static_assets = true